/
← Voltar ao feed
high technology software development

Hijacked AI coding assistant session recommends malicious PyPI package, seeding Shai-Hulud worm across ~100 internal repositories

1 fonte(s) · 1 atualização(ões) · publicado 02/10/2026 07:00 · coletado há 4 dias

In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and high-privilege GitHub OAuth tokens. The attacker then released the Shai-Hulud worm, which copied itself into about 100 internal repositories. A poisoned package appeared in the company's internal namespace and infected another employee. The article, a SafeDep blog post summarizing third-party research, also cites a newer Shai-Hulud variant that searches 469 credential locations, up from 189.

Detalhes técnicos

  • Three routes to hijacking an assistant are documented in the AI Risk and Resilience Report 2026: prompt injection, tampered startup hooks and weaponized agent skills.
  • Prompt injection: TeamPCP planted instructions that assistants followed as if typed by the user. They also targeted LLM-based security scanners, which then approved the same code.
  • Tampered hooks: attackers modified the command-line hooks an assistant runs on startup, so opening the project executed their code without any user approval.
  • Weaponized skills: in February, OpenClaw agent skills shipped with backdoors, droppers and infostealers.
  • The newer Shai-Hulud variant searches 469 locations for credentials, including CI systems, cloud configuration and settings files written to disk by AI development tools, where keys are often stored in plain text.
  • The report also describes a non-malicious failure: an autonomous agent stuck in a reasoning loop made more than 15,000 API calls in one hour, incurred about $50,000 in cloud bills and locked a database.
  • The article does not name the victim company or the PyPI package, and gives no IOCs.

Remediação

  • Treat AI-suggested packages like a pull request from a stranger. Verify checksums against the registry and an approved list before installation.
  • Scan every dependency that lands in the lockfile in CI, and pull dependencies through an internal proxy rather than directly from public registries.
  • Remove long-lived tokens from developer laptops. Use short-lived credentials and OIDC-based publishing.
  • Keep API keys and OAuth tokens away from editor extensions.
  • Grep AI tool config directories for plaintext secrets.
  • Review agent skills, extensions and MCP servers with the same care as dependencies.

Linha do tempo

  1. safedep.io ↗ · pub. 02/10/2026 07:00 · coletado 19/10 18:03 primeiro registro

    Hijacked AI coding assistant session recommends malicious PyPI package, seeding Shai-Hulud worm across ~100 internal repositories

    ler a análise desta fonte

    In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and high-privilege GitHub OAuth tokens. The attacker then released the Shai-Hulud worm, which copied itself into about 100 internal repositories. A poisoned package appeared in the company's internal namespace and infected another employee. The article, a SafeDep blog post summarizing third-party research, also cites a newer Shai-Hulud variant that searches 469 credential locations, up from 189.

    Technical Details

    • Three routes to hijacking an assistant are documented in the AI Risk and Resilience Report 2026: prompt injection, tampered startup hooks and weaponized agent skills.
    • Prompt injection: TeamPCP planted instructions that assistants followed as if typed by the user. They also targeted LLM-based security scanners, which then approved the same code.
    • Tampered hooks: attackers modified the command-line hooks an assistant runs on startup, so opening the project executed their code without any user approval.
    • Weaponized skills: in February, OpenClaw agent skills shipped with backdoors, droppers and infostealers.
    • The newer Shai-Hulud variant searches 469 locations for credentials, including CI systems, cloud configuration and settings files written to disk by AI development tools, where keys are often stored in plain text.
    • The report also describes a non-malicious failure: an autonomous agent stuck in a reasoning loop made more than 15,000 API calls in one hour, incurred about $50,000 in cloud bills and locked a database.
    • The article does not name the victim company or the PyPI package, and gives no IOCs.

    Remediation

    • Treat AI-suggested packages like a pull request from a stranger. Verify checksums against the registry and an approved list before installation.
    • Scan every dependency that lands in the lockfile in CI, and pull dependencies through an internal proxy rather than directly from public registries.
    • Remove long-lived tokens from developer laptops. Use short-lived credentials and OIDC-based publishing.
    • Keep API keys and OAuth tokens away from editor extensions.
    • Grep AI tool config directories for plaintext secrets.
    • Review agent skills, extensions and MCP servers with the same care as dependencies.